EC-Council Certified Incident Handler

• Cyber Incident Statistics
• Computer Security Incident
• Information as Business Asset
• Data Classification
• Common Terminologies
• Information Warfare
• Key Concepts of Information Security
• Vulnerability, Threat, and Attack
• Types of Computer Security Incidents
• Examples of Computer Security Incidents
• Verizon Data Breach Investigations Report – 2008
• Incidents That Required the Execution of Disaster Recovery Plans
• Signs of an Incident
• Incident Categories
• Incident Categories: Low Level
• Incident Categories: Middle Level
• Incident Categories: High Level

• Use of Disaster Recovery Technologies
• Impact of Virtualization on Incident Response and Handling
• Estimating Cost of an Incident
• Key Findings of Symantec Global Disaster Recovery Survey – 2009
• Incident Reporting
• Incident Reporting Organizations
• Vulnerability Resources

• Risk
• Risk Policy
• Risk Assessment
• NIST’s Risk Assessment Methodology

• Steps to Assess Risks at Work Place

• Risk Analysis

• Risk Mitigation

• Cost/Benefit Analysis
• NIST Approach for Control Implementation
• Residual Risk
• Risk Management Tools

• How to Identify an Incident
• Handling Incidents
• Need for Incident Response
• Goals of Incident Response
• Incident Response Plan

• Incident Response and Handling Steps

• Training and Awareness
• Security Awareness and Training Checklist
• Incident Management

• Incident Response Team

• Defining the Relationship between Incident Response, Incident Handling, and Incident Management

• What is CSIRT?
• What is the Need of an Incident Response Team (IRT)
• CSIRT Goals and Strategy
• CSIRT Vision
• Common Names of CSIRT
• CSIRT Mission Statement
• CSIRT Constituency
• CSIRT Place in the Organization
• CSIRT Relationship with Peers
• Types of CSIRT Environments
• Best Practices for creating a CSIRT

• Role of CSIRTs
• Roles in an Incident Response Team
• CSIRT Services

• CSIRT Policies and Procedures

• How CSIRT Handles a Case
• CSIRT Incident Report Form
• Incident Tracking and Reporting Systems

• CERT
• CERT-CC
• CERT(R) Coordination Center: Incident Reporting Form
• CERT:OCTAVE

• World CERTs

• http://www.first.org/about/organization/teams/
• http://www.apcert.org/about/structure/members.html
• IRTs Around the World

• Denial-of-Service Incidents
• Distributed Denial-of-Service Attack
• Detecting DoS Attack
• Incident Handling Preparation for DoS

• Unauthorized Access Incident

• Inappropriate Usage Incidents

• Multiple Component Incidents

• Network Traffic Monitoring Tools

• Network Auditing Tools

• Network Protection Tools

• Count of Malware Samples
• Virus
• Worms
• Trojans and Spywares
• Incident Handling Preparation
• Incident Prevention
• Detection of Malicious Code
• Containment Strategy
• Evidence Gathering and Handling
• Eradication and Recovery
• Recommendations
• Antivirus Systems

• Insider Threats
• Anatomy of an Insider Attack
• Insider Risk Matrix
• Insider Threats Detection
• Insider Threats Response
• Insider’s Incident Response Plan
• Guidelines for Detecting and Preventing Insider Threats

• Audit Trails and Log Monitoring
• Employee Monitoring Tools

• Computer Forensics
• Objectives of Forensics Analysis
• Role of Forensics Analysis in Incident Response
• Forensic Readiness
• Forensic Readiness And Business Continuity
• Types of Computer Forensics
• Computer Forensic Investigator
• People Involved in Computer Forensics
• Computer Forensics Process
• Digital Evidence
• Characteristics of Digital Evidence
• Collecting Electronic Evidence
• Challenging Aspects of Digital Evidence
• Forensic Policy
• Forensics in the Information System Life Cycle
• Forensic Analysis Guidelines
• Forensics Analysis Tools

• Tools Present in Helix CD for Windows Forensics

• Incident Reporting
• Why to Report an Incident
• Why Organizations do not Report Computer Crimes
• Whom to Report an Incident
• How to Report an Incident
• Details to be Reported
• Preliminary Information Security Incident Reporting Form
• CERT Incident Reference Numbers
• Contact Information

• Summary of Hosts Involved

• Description of the Activity

• Log Extracts Showing the Activity

• Time Zone
• Federal Agency Incident Categories
• Organizations to Report Computer Incident

• Incident Reporting Guidelines
• Sample Incident Reporting Form
• Sample Post Incident Report Form

• Incident Recovery
• Principles of Incident Recovery
• Incident Recovery Steps
• Contingency/Continuity of Operations Planning
• Business Continuity Planning
• Incident Recovery Plan
• Incident Recovery Planning Process

• Security Policy
• Key Elements of Security Policy
• Goals of a Security Policy
• Characteristics of a Security Policy
• Design of Security Policy
• Implementing Security Policies
• Acceptable Use Policy (AUP)
• Access Control Policy

• Asset Control Policy
• Audit Trail Policy

• Logging Policy

• Documentation Policy
• Evidence Collection Policy
• Evidence Preservation Policy
• Information Security Policy

• National Information Assurance Certification & Accreditation Process (NIACAP) Policy

• Physical Security Policy

• Physical Security Guidelines
• Personnel Security Policies & Guidance
• Law and Incident Handling

• Laws and Acts

• A: Fourth Amendment’s “Reasonable Expectation of Privacy” in Cases Involving Computers: General Principles
• A.4: Private Searches

• Intellectual Property Laws

Auditoriniai mokymai

Nuotoliniai mokymai